OVERVIEW

Infection Channel: Spammed via email

This ransomware is delivered as an attached document, via spam email. It disguises itself as a fake Thai customs form. Instead of the usual ransom note, MIRCOP demands to be paid back, assuming affected users know how ransomware payment works. It also asks for more than 40 bitcoins in payment - one of the highest seen as of this writing.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

This Trojan connects to the following website(s) to download and execute a malicious file:

http://www.{BLOCKED}y.nl/u/putty.exe

Information Theft

This Trojan steals the following information:

Filezilla

Windows Mail

Mozilla Firefox

Google Chrome

Opera

Filezilla

Skype

Other Details

This Trojan encrypts files with the following extensions:

.386

.a

.accda

.accdb

.accdc

.accde

.accdr

.accdt

.accdu

.acl

.ade

.adn

.adp

.ai

.aif

.aifc

.aiff

.ani

.ans

.api

.aps

.art

.asa

.asc

.ascx

.asf

.asm

.asmx

.asp

.aspx

.asx

.au

.avi

.aw

.bas

.bat

.bcp

.bin

.bkf

.blg

.bmp

.bsc

.btapp

.btkey

.btskin

.c

.cab

.camp

.cat

.cc

.cda

.cdmp

.cdx

.cer

.cgm

.chk

.chm

.cls

.cmd

.cod

.com

.config

.cpl

.cpp

.crd

.crds

.crl

.crt

.crtx

.cs

.csa

.csproj

.css

.csv

.cur

.cxx

.dat

.db

.dbg

.dbs

.dcr

.dct

.def

.der

.det

.dib

.dic

.dir

.disco

.diz

.dll

.dl_

.doc

.docm

.docx

.docxml

.dos

.dot

.dotm

.dotx

.dqy

.drv

.dsn

.dsp

.dsw

.dtd

.dwfx

.dxr

.easmx

.edrwx

.elm

.emf

.epf

.eprtx

.eps

.etp

.evt

.evtx

.exc

.exp

.ext

.ex_

.eyb

.fad

.faq

.fav

.fdf

.fdm

.fif

.fky

.fnd

.fnt

.fon

.gadget

.gcsx

.gfs

.ghi

.gif

.glk

.glox

.gmmp

.gqsx

.gra

.group

.grp

.grv

.gsa

.gta

.gz

.h

.H1C

.H1D

.H1F

.H1H

.H1K

.H1Q

.H1S

.H1T

.H1V

.H1W

.hdp

.hhc

.hlp

.hol

.hpp

.hqx

.hta

.htc

.htm

.html

.htt

.htw

.htx

.hxa

.hxc

.hxd

.hxe

.hxf

.hxh

.hxi

.hxk

.hxq

.hxr

.hxs

.hxt

.hxv

.hxw

.hxx

.i

.ibc

.ibq

.icc

.icl

.icm

.ico

.ics

.idl

.idq

.ilk

.imc

.img

.inc

.inf

.ini

.inl

.inv

.inx

.in_

.iqy

.iso

.IVF

.jar

.jav

.java

.jbf

.jfif

.jnlp

.jnt

.Job

.jod

.jpe

.jpeg

.jpg

.js

.JSE

.jtp

.jtx

.kci

.label

.laccdb

.latex

.ldb

.lex

.lgn

.lib

.lnk

.local

.log

.lst

.m14

.m1v

.m3u

.m4a

.mad

.maf

.mag

.mak

.mam

.man

.maq

.mar

.mas

.mat

.mau

.mav

.maw

.mda

.mdb

.mde

.mdn

.mdt

.mdw

.mgc

.mht

.mhtml

.mid

.midi

.mig

.mk

.mlc

.mmf

.mml

.mmw

.mov

.movie

.mp2

.mp2v

.mp3

.mpa

.mpe

.mpeg

.mpf

.mpg

.mpv2

.msc

.msg

.msi

.msp

.msu

.mv

.mydocs

.ncb

.nfo

.nick

.nk2

.nls

.nvr

.obj

.ocx

.oc_

.odc

.odh

.odl

.odt

.ofs

.oft

.ols

.one

.onepkg

.onetoc

.opc

.oqy

.osdx

.ost

.otf

.otm

.p10

.p12

.p7b

.p7c

.p7m

.p7r

.p7s

.pab

.pbk

.pcb

.pch

.pdb

.pdf

.pdfxml

.pds

.pdx

.pfm

.pfx

.php3

.pic

.pif

.pip

.pko

.pl

.plg

.pls

.pma

.pmc

.pml

.pmr

.pnf

.png

.pot

.potm

.potx

.ppa

.ppam

.pps

.ppsm

.ppsx

.ppt

.pptm

.pptx

.pptxml

.prc

.prf

.ps

.ps1

.ps1xml

.psc1

.psd

.psd1

.psm1

.pst

.pub

.pwz

.py

.pyc

.pyo

.pys

.pyw

.qds

.rat

.rc

.rc2

.rct

.RDP

.reg

.rels

.res

.rgs

.rle

.rll

.rmi

.rpc

.rqy

.rsp

.rtf

.rul

.rwz

.s

.sbr

.sc2

.scc

.scd

.scf

.sch

.scp

.scr

.sct

.sdl

.sed

.shtm

.shtml

.sit

.sldm

.sldx

.slk

.snd

.sol

.sor

.spc

.sql

.srf

.sr_

.sst

.stl

.stm

.swf

.sym

.sys

.sy_

.tab

.tar

.tdl

.text

.tgz

.theme

.thmx

.tif

.tiff

.tlb

.tlh

.tli

.trg

.tsp

.tsv

.ttc

.ttf

.txt

.udf

.UDL

.udt

.URL

.user

.usr

.uxdc

.vb

.VBE

.vbproj

.vbs

.vbx

.vcf

.vcg

.vcproj

.vcs

.vdx

.viw

.vsd

.vspscc

.vss

.vsscc

.vssscc

.vst

.vsx

.vtx

.vxd

.wab

.wav

.wax

.wbcat

.wbk

.wcx

.wdp

.webp

.webpnp

.wiz

.wll

.wlt

.wm

.wma

.wmf

.wmp

.wmv

.wmx

.wmz

.wpl

.wps

.wpt

.wri

.wsc

.wsdl

.WSF

.WSH

.wsz

.wtf

.wtx

.wvx

.x

.xaml

.xbap

.xdp

.xdr

.xfdf

.xht

.xhtml

.xix

.xla

.xlam

.xlb

.xlc

.xlk

.xll

.xlm

.xls

.xlsb

.xlsm

.xlsx

.xlt

.xltm

.xltx

.xlw

.xlxml

.xml

.xps

.xrm-ms

.xsd

.xsf

.xsl

.xslt

.xsn

.xst

.xtp

.z

.z96

.zip

It renames encrypted files using the following names:

Lock.{original filename and extension}

SOLUTION

Minimum Scan Engine: 9.800

FIRST VSAPI PATTERN FILE: 12.608.05

FIRST VSAPI PATTERN DATE: 23 Jun 2016

VSAPI OPR PATTERN File: 12.609.00

VSAPI OPR PATTERN Date: 24 Jun 2016

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Delete this registry value

[ Learn More ]

[ back ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Control Panel\Desktop

Wallpaper = "%User Temp%\wl.jpg"

To delete the registry value this malware created:

Open Registry Editor. To do this: » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter. » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter. » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.

In the left panel of the Registry Editor window, double-click the following: HKEY_CURRENT_USER>Control Panel>Desktop

In the right panel, locate and delete the entry:Wallpaper = "%User Temp%\wl.jpg"

Close Registry Editor.

Step 4

Scan your computer with your Trend Micro product to delete files detected as RANSOM_MIRCOP.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.